Lucene search
+L

7588 matches found

Vulnrichment
Vulnrichment
added 2026/09/01 3:18 p.m.8 views

CVE-2026-84232 Pulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg content

A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type e.g., text/html for .html files, image/svg+xml for .svg files and without a Content-Disposition: attachment header when using local filesystem...

5.4CVSS5.8AI score0.00176EPSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/01 9:04 a.m.6 views

CVE-2025-55182-Proof-of-Concept

CVE-2025-55182 Preuve de concept Ce dépôt contient une preuve de concept PoC pour CVE-2025-55182 , une vulnérabilité impliquant une pollution de prototype menant à une exécution de code à distance RCE dans certaines implémentations de rendu côté serveur. ⚠️ Avertissement : Cette PoC est strictemen...

10CVSS7AI score0.99802EPSS
SaveExploits389
Kitploit
Kitploit
added 2026/09/01 4:29 a.m.6 views

CVE-2025-57298

XSS stocké via un rendu Markdown non sûr dans Kotaemon Résumé Kotaemon est un système de questions-réponses documentaire open source basé sur le RAG Retrieval-Augmented Generation qui fournit une interface web pour interroger des documents téléchargés tels que des fichiers PDF, Word et Excel. Une...

5.8AI score
SaveExploits0
NVD
NVD
added 2026/08/31 4:19 p.m.12 views

CVE-2026-82805

A vulnerability was found in Typora up to 1.13.8/1.14.6. This vulnerability affects unknown code of the component Mermaid Rendering Engine. The manipulation of the argument classDef/style results in cross site scripting. The attack may be launched remotely. The exploit has been made public and...

5.3CVSS0.00282EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/08/31 3:45 p.m.5 views

EUVD-2026-68614

A vulnerability was found in Typora up to 1.13.8/1.14.6. This vulnerability affects unknown code of the component Mermaid Rendering Engine. The manipulation of the argument classDef/style results in cross site scripting. The attack may be launched remotely. The exploit has been made public and...

5.3CVSS4.4AI score0.00282EPSS
SaveExploits0References7
CVE
CVE
added 2026/08/31 3:45 p.m.9 views

CVE-2026-82805

Typora (versions up to 1.13.8/1.14.6) is affected by a cross-site scripting (XSS) vulnerability in its Mermaid Rendering Engine . The flaw is triggered by manipulation of the classDef/style argument, and the attack can be launched remotely, though it requires user interaction (e.g., opening a cra...

5.3CVSS4.4AI score0.00282EPSS
SaveExploits0References7
Kitploit
Kitploit
added 2026/08/31 3:05 p.m.5 views

CVE-2022-30507-PoC

Description Exécution de code à distance RCE en exécutant du code JavaScript - Cross-site scripting XSS et processus de rendu via nodeintegration, qui est responsable du processus de rendu et de l'accès au code Node.js. Vidéo PoC Référence...

5.9AI score
SaveExploits2
RedHat Linux
RedHat Linux
added 2026/08/31 2:32 p.m.8 views

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering

A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting XSS attacks, where...

6.1CVSS6.2AI score0.00223EPSS
SaveExploits0References8
Kitploit
Kitploit
added 2026/08/31 1:08 p.m.4 views

CVE-2025-68116

CVE-2025-68116 Auteur : @x0root Vulnérabilité : Cross-Site Scripting XSS stocké via des téléversements interprétables par le navigateur SVG / HTML Logiciel concerné : FileRise Note : GHSA-qrcv-vjvf-fr29 a introduit une atténuation qui empêchait le rendu des SVG dans...

8.9CVSS5.9AI score0.0026EPSS
SaveExploits1
Cvelist
Cvelist
added 2026/08/31 10:51 a.m.40 views

CVE-2026-82881 Aix-DB through 1.2.4 Stored Cross-Site Scripting via Markdown

Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and JavaScript through markdown content in chat responses, skill descriptions, or knowledge messages that execut...

5.4CVSS0.00188EPSS
SaveExploits0References6
CVE
CVE
added 2026/08/31 10:51 a.m.14 views

CVE-2026-82881

Aix-DB through version 1.2.4 is vulnerable to stored cross-site scripting (XSS) . The root cause is that markdown is rendered with raw HTML enabled and bound to v-html without sanitization (specifically in web/src/components/MarkdownPreview/plugins/markdown.ts). An attacker with low privileges ca...

5.4CVSS5.8AI score0.00188EPSS
SaveExploits0References6
OSV
OSV
added 2026/08/31 10:51 a.m.5 views

CVE-2026-82881 Aix-DB through 1.2.4 Stored Cross-Site Scripting via Markdown

Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and JavaScript through markdown content in chat responses, skill descriptions, or knowledge messages that execut...

5.1CVSS5.8AI score
SaveExploits0References8
NVD
NVD
added 2026/08/31 9:17 a.m.9 views

CVE-2026-82868

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute...

6.1CVSS0.00155EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/31 8:46 a.m.7 views

CVE-2026-82868

@pdfme/schemas versions before 5.5.9 contain a cross-site scripting (XSS) vulnerability in the SVG schema plugin . User-supplied SVG content is rendered directly to innerHTML without sanitization , allowing attackers to inject malicious SVG with embedded scripts, event handlers, or foreignObject ...

6.1CVSS6AI score0.00155EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/31 8:46 a.m.4 views

EUVD-2026-68403

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute...

6.1CVSS6AI score0.00155EPSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/08/31 7:16 a.m.4 views

CVE-2025-55780

CVE-2025-55780 Déréférencement de pointeur nul dans la fonction de rendu EPUB de MuPDF 1.26.4 Référence CVE - CVE-2025-55780 Versions affectées : 1.26.7 et versions antérieures Découvert et testé sur : 1.26.4 Score de sévérité CVSSv3 : 7.5 Élevé Corrigé dans le commit :...

7.5CVSS5.9AI score0.00428EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/08/31 5:26 a.m.3 views

CVE-2026-28496-Lab

CVE-2026-28496 - Injection de modèles côté serveur dans le rendu Twig de FOSSBilling Résumé exécutif Ce dépôt contient un laboratoire Docker local pour reproduire et valider CVE-2026-28496, une vulnérabilité d'injection de modèles côté serveur affectant le comportement de rendu des modèles Twig d...

9.4CVSS5.8AI score0.01905EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/08/31 5:15 a.m.5 views

CVE-2026-999999

X-Trading Portal: Infrastructure Financière Régionale v1.4.2 Aperçu Ce dépôt contient les configurations de distribution et de déploiement centrales pour le X-Trading Portal XTP , une solution conteneurisée conçue pour les services bancaires de détail et de négociation d'actions. Cette version...

5.9AI score
SaveExploits0
Kitploit
Kitploit
added 2026/08/31 4:19 a.m.4 views

POC-CVE-2026-19626

CVE-2026-19626 — RCE при генерации отчётов аутентифицированный, не администратор Статус: ПОДТВЕРЖДЕНО — полностью удалённый эксплойт, без прав администратора, только REST лаборатория 6.7.2-14.el9, 2026-08-21. Эксплуатационная цепочка именно это выполняет poc.py: 1. войдите как любой обычный...

9.9CVSS5.8AI score0.01444EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/08/31 3:43 a.m.4 views

CVE-2025-24893

Preuve de concept XWiki CVE-2025-24893 Auteurs : Net.Doge & Infinit3i Ce script Python exploite CVE-2025-24893 , une vulnérabilité d'exécution de code à distance RCE dans XWiki causée par un sandboxing inadéquat dans les macros Groovy exécutées de manière asynchrone. Il permet l'exécution de...

9.8CVSS7.3AI score0.99864EPSS
SaveExploits52References3
Rows per page
Query Builder